SSO with multiple Google domains

[Cantor, Scott]

> I haven't yet had a chance to look at Scott's impersonation implementation,
> but a combination of your (Andrew) solution -- which is similar to ours,
> except that our users in secondary domains get their primary accounts in the
> secondary domain and an alias to the primary -- and impersonation would
> probably solve the issue.  If the user's logging into Google, prompt them in
> the post-authentication intercept to select their desired Google account
> based on the selection in their directory object.
> 
> If I understand correctly...

Could be. It's probably scary all the ways that will end up getting used that I don't want to know about but at least it's safe and constrained from my point of view trying to explain behavior.

-- Scott